'summarize' operator: Failed to resolve scalar expression named 'TimeGenerated'

Hi Dapeng Li,

Put shortly - once you apply the first `summarize` by instance name and computer, you lose the TimeGenerated column. I suggest you add the "bin" you use on the second `summarize` to the first one.

Additionally, when you use "join" you might over-complicate the query, and make it less efficient.

I suggest the following query (changed the first string to match our demo data)

let containerNames = Perf 
| where InstanceName like 'e4272367-5645-4c4e-9c67-3b74b59a6982'
| where ObjectName == 'K8SContainer'
| where CounterName == "memoryRssBytes"
| distinct InstanceName;
Perf
| where InstanceName in (containerNames)
| where CounterName == "memoryRssBytes"
| extend usage = tolong(CounterValue)
| extend usageMB = usage * 1.0/(1024*1024)
| summarize maxUsageMB=max(usageMB) by InstanceName, Computer, bin(TimeGenerated, 2h)
| summarize sum(maxUsageMB) by Computer, bin(TimeGenerated, 2h)

HTH,

Noa